Validate and Analyze Unit Hardening Score Before Deployment

systemd-analyze verify parses a unit file and its dependencies, reporting syntax errors, missing executables, unknown directives, and dependency cycles without starting anything. systemd-analyze security then evaluates the sandboxing directives and produces a numeric exposure score from 0.0 (fully locked down) to 10.0 (wide open), listing each unset hardening knob with a weight. Internally, verify uses the same unit parser as PID 1, so it catches directives that would otherwise be silently ignored at runtime; security uses a static rule table mapping directives like ProtectSystem, RestrictAddressFamilies, and SystemCallFilter to point deductions.

In a production CI pipeline, run verify on every commit that touches a unit file and fail the build if security reports an exposure above a threshold, for example 2.0 for internet-facing services. This turns hardening into a testable gate rather than a code-review afterthought. It is also the fastest way to audit inherited units during a migration from SysV init, because it flags the dozens of directives that no longer exist.

Pitfalls: verify requires all referenced binaries to exist, so run it inside the target container or with --root pointing at a staging rootfs. security does not account for application-level behavior, so a low score does not mean the service is safe, and an unavoidable high score for a service needing broad filesystem access should be documented and accepted rather than silently bypassed. Combine both checks, store the JSON output from security --json=short in your compliance artifacts, and diff scores across releases to catch regressions.

> System.Execute()

# Fail CI if a unit is broken or too exposed
gate=2.0
for unit in ./units/*.service ./units/*.socket ./units/*.timer; do
  systemd-analyze verify "$unit" || exit 1
  score=$(systemd-analyze security --offline=yes --json=short "$unit" \
    | jq -r '.exposure // 10')
  echo "$unit exposure=$score"
  awk -v s="$score" -v g="$gate" 'BEGIN{exit !(s>g)}' && {
    echo "FAIL: $unit exceeds gate $gate"; exit 1
  }
done
systemd-analyze security --offline=yes --no-pager /etc/systemd/system/payments-api.service

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-DB6F1871C31D